Connection strings
Finds connection URIs in tracked source — legacy plaintext protocols, database URIs, and anything carrying inline credentials.
What it checks
Scans tracked files for connection URIs (legacy schemes like FTP/Telnet/SMB/NFS/rsync, database schemes like MongoDB/Postgres/MySQL/Redis, JDBC, plain HTTP, plain LDAP). URIs with inline credentials are reported as errors.
Reported categories: creds_in_url, ftp, telnet, smb, nfs, rsync, ldap_unencrypted, jdbc, db_uri, http_remote.
A URI that carries inline credentials (scheme://user:password@host) is raised to error severity — that is a leaked secret, not a protocol preference. Everything else reports at info: a http:// link in a comment is worth seeing, not worth blocking a release over.
What a finding says
Credentials in URL in src/db.py:9. A URI carrying user:password leaks the credential to anyone who reads the file.Turning it off
Silence the gate for the whole project in .l0git.json:
{
"ignore": ["connection_strings"]
}Or keep it running at a lower severity:
{
"severity": { "connection_strings": "info" }
}